CVE-2023-52770

CVE-2023-52770 is a Linux-kernel (f2fs) issue: the bug stems from how extent_cache is allocated, with a split between initial and dynamic conditions that could trigger a panic during extent_cache updates (observed during a file creation with compressed flag and subsequent operations). The vulnera...

CVE-2023-52911

CVE-2023-52911 is a Linux kernel issue in the DRM/MSM driver related to a NULL pointer dereference when the Adreno GPU runs in headless mode (e.g., on i.MX platforms). The crash occurs during reboot in the msm_atomic_commit_tail path, with an oops/NULL dereference involving slab kmalloc and relat...

CVE-2023-53003

CVE-2023-53003 concerns a use-after-free in the Linux kernel’s EDAC/qcom path. The LLCC driver allocates llcc_driv_data, which was previously passed as private info to the EDAC core (edac_device_ctl_info). On driver release this data could be freed, and a subsequent probe would use the freed memo...

CVE-2023-53178

CVE-2023-53178 affects the Linux kernel’s memory management path, specifically the mm/zswap.c writeback logic. The vulnerability is a race condition in the zswap writeback entry handling that can lead to memory corruption: a swapped-out page can be swapped back in with data from a different page....

CVE-2024-41052

CVE-2024-41052 : In the Linux kernel, the VFIO PCI subsystem misused an uninitialized local variable named count during collection of hot-reset devices, causing device-counting mistakes and possible userspace crashes when invoking the hot‑reset info path. The issue has been resolved by initializi...

CVE-2024-41083

CVE-2024-41083 affects the Linux kernel netfs code path. The flaw in netfs_page_mkwrite() could dereference a NULL folio->mapping when the folio lock is held, causing kernel oopses during mmap/write scenarios. The fix ensures folio->mapping is valid after taking the folio lock (consistent w...

CVE-2024-43836

CVE-2024-43836 affects the Linux kernel net: ethtool pse-pd path. A null dereference can occur when a PSE supports both c33 and PoDL but only one Netlink attribute is provided; the vulnerability arises although the c33/PoDL capabilities are validated by ethnl_set_pse_validate(). The issue has bee...

CVE-2024-56553

CVE-2024-56553 is a Linux kernel memory-leak fix in the binder subsystem. The issue occurred when a freeze notification is cleared (BC_CLEAR_FREEZE_NOTIFICATION) before binder_freeze_notification_done(), leaving entries in proc->delivered_freeze queued and leaking on process exit. The patch en...

CVE-2024-57934

The CVE-2024-57934 entry concerns a race in Linux kernel fgraph handling where fgraph_array[] access can race with updates to a fgraph_stub, potentially triggering a NULL pointer dereference. The fixed patch adds READ_ONCE() protection when accessing fgraph_array[] to ensure consistency between t...

CVE-2024-58015

CVE-2024-58015 affects the Linux kernel wifi driver ath12k. The root cause is an out-of-bounds memory access in self-generated stats where an overly large length is passed to print_array_to_buf_index(). The fix reduces the buffer size by one to correct the upper bound. Impact is described as an o...

CVE-2025-21717

CVE-2025-21717 affects the Linux kernel mlx5e path: kvzalloc_node lacks cpu_to_node conversion, allowing an out-of-bounds access when ethtool/netlink calls mlx5e_open on a CPU above MAX_NUMNODES, potentially panicking the kernel. The issue is fixed by adding a missing cpu_to_node conversion to ml...

CVE-2025-21901

CVE-2025-21901 : In the Linux kernel’s RDMA bnxt_re driver, there are missing sanity checks for rdev validity. If ulp_irq_stop and ulp_irq_start callbacks are invoked while a device is in a detached state, a NULL pointer dereference can occur because the rdev may already be freed, potentially cau...

CVE-2025-21921

CVE-2025-21921: In the Linux kernel, net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device, the crash occurs in ethnl_req_get_phydev() when tb is NULL (e.g., ethnl notify path) and a phy_device lookup is performed. The fix passes the cmd index and nlattr array separately to allow NU...

CVE-2025-38056

The CVE-2025-38056 vulnerability affects the Linux kernel ASoC: SOF Intel HDA path. Specifically, hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string and storing it into a global, which becomes a freed pointer after module unloads, enabling a use-after-free...

CVE-2025-38347

CVE-2025-38347 is tied to a Linux kernel issue in the F2FS file system. The description details a deadlock scenario during mknod in a corrupted directory, caused by locking the directory inode page twice while processing ACL/xattrs. The root cause is a mismatch between inode number and xattr inod...

CVE-2025-38576

CVE-2025-38576 affects the Linux kernel PowerPC EEH hotplug path. Root cause: race conditions between the PCIe hotplug driver and the EEH driver can yield kernel oops during unplug/recovery cycles and bus disappearance. Resolution: refactor the EEH module to be PCI rescan and remove safe, with cl...

CVE-2025-38604

CVE-2025-38604 relates to the Linux kernel Wi‑Fi driver RTL818x (rtl8187). The root cause was that URBs were not killed before clearing the transmit status queue, allowing callbacks to access freed skbs and potentially triggering a NULL pointer dereference (kernel crash). The fix moves usb_kill_a...

CVE-2026-22991

CVE-2026-22991 is a Linux kernel vulnerability in the libceph code path. A NULL pointer dereference could occur in free_choose_arg_map() when a caller triggers a partial allocation (for example, decode_choose_args() may set arg_map->size before memory allocation and then fail). The fix adds nu...

CVE-2026-23392

The CVE-2026-23392 vulnerability affects the Linux kernel nf_tables flowtable handling. Root cause: during error paths, a hook may still reference a flowtable, exposing it to the packet path and nfnetlink control plane. The fix inserts synchronize_rcu() after unregistering hooks (rcu grace period...

CVE-2026-31414

CVE-2026-31414 (Linux kernel netfilter nf_conntrack_expect) The vulnerability arises from using nfct_help() without holding a reference to the master conntrack, leading to unsafe references when the helper is dumped via ctnetlink and /proc. The fix switches to using exp->master->helper in t...

CVE-2026-46137

CVE-2026-46137 affects the Linux kernel MPTCP implementation. The mptcp_pm_add_timer() helper runs as a timer callback in softirq context and can race with socket state unless the socket lock is held with bh_lock_sock(). The mitigation is to hold the lock and retry if the socket is in use, mirror...

CVE-2026-52911

The CVE-2026-52911 vulnerability affects the Linux kernel ksmbd code path. When a SESSION_SETUP binds a connection (conn->binding = true), a global session lookup could incorrectly resolve sessions not actually added to the connection’s session list. The fix tightens the global lookup so that ...

CVE-2026-53357

CVE-2026-53357 affects the Linux kernel Bluetooth stack. Root cause: a race where a concurrent HCI disconnect can trigger l2cap_conn_del() to free a child socket via l2cap_sock_kill while cleanup_listen() still accesses it, causing a use-after-free (KASAN) in l2cap_sock_cleanup_listen() during cl...

CVE-2003-1604

CVE-2003-1604 relates to the Linux kernel vulnerability in net/netfilter/nf_nat_redirect.c: nf_nat_redirect_ipv4. The connected Nessus entries indicate that Linux kernels before 4.4 are affected, where remote attackers can cause a denial of service (NULL pointer dereference/system crash) by sendi...

CVE-2004-1069

CVE-2004-1069 describes a race condition affecting SELinux-enabled Linux kernels in the 2.6.x series (through 2.6.9) when handling AF_UNIX network packets. Local attackers could cause a kernel DoS (kernel crash) via SOCK_SEQPACKET Unix domain sockets due to improper handling in sock_dgram_sendmsg...

CVE-2005-0124

Technical details about CVE-2005-0124 are not provided in the supplied documents. No concrete affected product/version or root cause information is present here; monitor for updates from official advisories.

CVE-2005-0489

CVE-2005-0489 affects Linux kernel 2.4.x prior to 2.4.17, where local attackers can trigger a denial of service by causing an invalid access of freed memory in /proc handling (proc/base.c). The OpenVAS/Debian entries confirm this CVE as part of the 2.4 kernel vulnerabilities and reference Debian ...

CVE-2006-4813

Concrete details found: CVE-2006-4813 affects the Linux kernel 2.6.x prior to 2.6.13, where __block_prepare_write in fs/buffer.c fails to clear buffers under certain error conditions, allowing a local user to read portions of files that have been unlinked. Impact is partial confidentiality; explo...

CVE-2007-5501

The CVE-2007-5501 entries confirm a vulnerability in the Linux kernel 2.6.21–2.6.23.7 and 2.6.24-rc through 2.6.24-rc2 where remote attackers can cause a denial of service (crash) by sending crafted ACKs that trigger a NULL pointer dereference in net/ipv4/tcp_input.c (tcp_sacktag_write_queue). Th...

CVE-2008-3496

CVE-2008-3496 affects the Linux kernel uvcvideo (V4L) in drivers/media/video/uvc/uvc_driver.c, where a buffer overflow in format descriptor parsing occurs in uvc_parse_format. Affected are kernels older than 2.6.26.1; the ChangeLog indicates this version contains the fix. Public disclosures in SU...

CVE-2008-7256

CVE-2008-7256 affects the Linux kernel’s mm/shmem.c prior to 2.6.28-rc8 when strict overcommit is enabled and CONFIG_SECURITY is disabled. The vulnerability arises in how knfsd exports shmemfs objects, allowing a denial of service via NULL pointer dereference and knfsd crash, with possible other ...

CVE-2009-0787

The CVE-2009-0787 issue affects the Linux kernel 2.6.28 series (before 2.6.28.9) in the eCryptfs component. The root cause is an incorrect size being used when writing kernel memory to the eCryptfs file header, which triggers an out-of-bounds read and allows a local user to obtain portions of ker...

CVE-2011-1747

CVE-2011-1747 affects the Linux kernel AGP subsystem (2.6.38.5 and earlier). The vulnerability stems from inadequate restriction of memory allocations for AGPIOC_RESERVE and AGPIOC_ALLOCATE ioctls in the AGP driver, allowing a local attacker with access to the video subsystem to induce memory exh...

CVE-2011-3619

CVE-2011-3619 affects the Linux kernel (before 3.0) via AppArmor’s apparmor_setprocattr in security/apparmor/lsm.c. Unvalidated parameters can trigger a NULL pointer dereference/OOPS by writing to /proc/#####/attr/current, enabling local denial-of-service; kernel patch exists in 3.0+ (see ChangeL...

CVE-2011-4087

CVE-2011-4087 affects the Linux kernel up to version 2.6.38, where the function br_parse_ip_options in net/bridge/br_netfilter.c fails to initialize a data structure properly. This can allow remote attackers to cause a denial of service by manipulating connectivity to an Ethernet bridge-enabled n...

CVE-2013-1959

The CVE-2013-1959 issue affects the Linux kernel up to version 3.8.8. kernel/user_namespace.c does not enforce proper capabilities for uid_map and gid_map files, allowing a local user to gain privileges by first opening a file in an unprivileged process and then modifying it in a privileged proce...

CVE-2013-3230

CVE-2013-3230 affects the Linux kernel prior to 3.9-rc7: l2tp_ip6_recvmsg in net/l2tp/l2tp_ip6.c fails to initialize a structure member, allowing local users to obtain sensitive information from kernel stack memory via a crafted recvmsg/recvfrom. The issue is mitigated by updating the kernel to 3...

CVE-2014-3183

CVE-2014-3183 is a heap-based buffer overflow in the Linux kernel driver HID Logitech DJ (logi-dj_ll_raw_request in drivers/hid/hid-logitech-dj.c) exposed when a device reports a large LED report. Affected kernel versions are earlier than 3.16.2. This allows physically proximate attackers to caus...

CVE-2016-7912

The CVE-2016-7912 entry describes a use-after-free in the Linux kernel involving ffs_user_copy_worker in drivers/usb/gadget/function/f_fs.c, prior to version 4.5.3. This flaw lets local users escalate privileges by accessing an I/O data structure after a callback, as documented in multiple source...

CVE-2017-0427

CVE-2017-0427 is an elevation-of-privilege vulnerability in the Android kernel file system. A local attacker could execute arbitrary code in the kernel context on devices running Kernel-3.10 or Kernel-3.18, with a potential for permanent device compromise. The CVE’s patch status is not publicly a...

CVE-2017-0429

CVE-2017-0429 is an elevation-of-privilege vulnerability in the NVIDIA kernel driver’s i2c-hid component, enabling a local attacker to write arbitrary values to kernel memory and potentially execute code with kernel privileges. Public descriptions tie the issue to the NVIDIA kernel driver on Andr...

CVE-2017-0440

CVE-2017-0440 describes an elevation-of-privilege flaw in the Qualcomm Wi‑Fi driver for Android kernels 3.10 and 3.18. A local malicious app could exploit it to execute code in the kernel context, after compromising a privileged process. The vulnerability is classified as High severity in the pub...

CVE-2018-19406

CVE-2018-19406 affects the Linux kernel up to version 4.19.2, specifically kvm_pv_send_ipi in arch/x86/kvm/lapic.c. A crafted system call can reach a state where the APIC map is uninitialized, leading to a NULL pointer dereference and a BUG, causing a local denial of service. Connected advisories...

CVE-2021-47130

The CVE refers to a Linux kernel fix in nvmet: when a p2p device is found but the p2p pool is empty, the nvme target incorrectly freed the sgl from the p2p pool, leading to a BUG() crash. The fix ensures the nvme request only uses the p2p_dev if it was allocated from the p2p pool, avoiding freein...

CVE-2021-47132

CVE-2021-47132 refers to a Linux kernel issue in the MPTCP code where sk_forward_memory could be corrupted during retransmission due to unsafe updates that did not acquire the msk spin lock. A fix was introduced that adds a new variant of the blamed function which explicitly acquires the msk spin...

CVE-2021-47316

CVE-2021-47316: In the Linux kernel, nfsd: fix NULL dereference in nfs3svc_encode_getaclres where error cases may leave dentry NULL. Affected component is the NFS daemon encoder (nfs3acl.c); root cause is improper handling in the XDR encoder initialization leading to a NULL dereference. The issue...

CVE-2021-47322

CVE-2021-47322 affects the Linux kernel NFSv4 pnfs_mark_request_commit() when rescheduling a set of writes on the commit list after a failed pNFS attempt, causing an OOPS in O_DIRECT paths. The vulnerability is addressed by fixes in the kernel (as described in the CVE entry and linked references)...

CVE-2022-48753

CVE-2022-48753 : In the Linux kernel, a memory leak affects the disk Register/IA ranges path. The root cause is an extra reference from kobject_init_and_add() when it fails, leading to allocated memory not being freed. The fix adds a kobject_put() call to ensure proper cleanup and updates the blk...

CVE-2022-48779

In the Linux kernel, a use-after-free was fixed in the net: mscc: ocelot driver (ocelot_vlan_del). The bug occurred because ocelot_vlan_member_del() freed the ocelot_bridge_vlan struct which could still be accessed via the port’s pvid_vlan. The fix determines whether to clear ocelot_port->pvid...

CVE-2022-48803

In CVE-2022-48803, the Linux kernel patch fixes a bounds issue in the TI PHY code used on the TI J721e platform. _get_table_maxdiv() could read beyond clk_div_table in phy-j721e-wiz.c, triggering a global-out-of-bounds access reported under KASAN. The remediation is adding a sentinel entry to clk...